Download as PDF, PPTX
More Related Content
Similar to Cloud Security Governance
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Cloud Security Governance
- 1. Shankar Subramaniyan ISACA GreaterHouston Chapter August 17,2017 Cloud Security Governance 1
- 2. • Why CloudSecurity ? • Cloud Service Provider Security • Cloud Consumer Security • Major Challenges in implementation 2 Agenda
- 3.
- 4. KEY CONCERNS Attack Vector Lackof Visibility Loss of Control Physical Inaccessibility Cross Border Laws Multi Tenancy Data Privacy Regulatory Compliance
- 5. Top Security Risks 5 ComplianceRisks Data Leakage/Loss Insecure Cloud Software Malicious use of Cloud services Account hijacking Malicious Insider Loss of Governance Lock-In Isolation Failure Management Interface Compromise Insecure or Incomplete Data Deletion Administrative or legal outages
- 6. 6 Cloud Security Risks Unauthorized use/Analytics Outage of Cloud services due to employee error Data Mix-up Hospital gown vulnerability Data Leakage Misconfigured cloud storage exposed to internet Cloud hosted malware 73% of Companies Have Critical Security Misconfigurations - Threat Stack 44 percent of malware in enterprise cloud apps delivered ransomware -Netskope
- 7. Cloud Types 7 Private, Community Public &Hybrid Clouds
- 8. Cloud Security ProviderSecurity 8
- 9.
- 10. Cloud Security Guidance 10https://cloudsecurityalliance.org/guidance/#_overview Contracts Management Plane NewAudit Skill Software defined infrastructure Short lived virtual assets Image Protection DevOps Server less ArchitectureDirect storage access Open source CSPCustomer
- 11. Cloud GRC Stack 11 Delivering Stack Pack Description Continuous monitoring … with a purpose • Common technique and nomenclature to request and receive evidence and affirmation of current cloud service operating circumstances from cloud providers Claims, offers, and the basis for auditing service delivery • Common interface and namespace to automate the Audit, Assertion, Assessment, and Assurance (A6) of cloud environments Pre-audit checklists and questionnaires to inventory controls • Industry-accepted ways to document what security controls exist The recommended foundations for controls • Fundamental security principles in specifying the overall security needs of a cloud consumers and assessing the overall security risk of a cloud provider https://cloudsecurityalliance.org/research/grc-stack/#_overview
- 12. Cloud Consumer Security 12 Through2020, 80% of cloud breaches will be due to customer misconfiguration, mismanaged credentials or insider theft, not cloud provider vulnerabilities -Gartner
- 13. Consumer Security Responsibilities 13 DDoS Protecti on ACLs Virtual Networ k Isolatio n NSGs VM Firewall •Security Configuration • Redundancy (ISP/CSP) • Access management • Source Control/Drifting • Network Segregation • Monitoring • Patch management (IAAS)
- 14. Additional Security Services-IAAS 14 CloudTrail AWS Config CloudWatch Alarms AWS Trusted Advisor AWS IAM AWS KMS • Log Monitoring and Alerts • Performance monitoring • Configuration management • Vulnerability scanning • Encryption • Identity and Access Management • End Point Security Module • Network Security- FW,IDS/IPS,WAF • Antimalware Azure Security center https://summitroute.com/blog/2017/05/30/free_tools_for_auditing_the_security_of_an_aws_account/ Netflix Security Monkey
- 15. Challenges in Implementation •Cloud Discovery • Gaps in contract • Challenges in Cloud Supply Chain • Rapidly changing services and architecture 15 https://www.skyhighnetworks.com/cloud-security-university/what-is-shadow-it/ Shadow IT Cloud Usage -Skyhigh
- 16.